Office of Compliance & Privacy Affairs Presentation to the SF - PowerPoint PPT Presentation

San Francisco Department of Public Health Office of Compliance & Privacy Affairs Presentation to the SF Department of Public Health Health Commission – November 3, 2015 1

Overview 1. What is Compliance? 2. What is Privacy? 3. Office of Privacy and Compliance Affairs (OCPA) 4. The Hard News: Whistleblowers, Privacy Breaches, Disallowances 5. The Good News: • Increasing Knowledge • Improving Policies • Establishing Data Breach Response • Establishing Data Sharing Governance • Improving Data Security • Making Institutional Commitments 6. Challenges 2

What is Compliance? REGULATIONS GOALS  Federal Medicare Medicaid  Prevent illegal/unethical conduct Conditions of Participation  Assure employees are allowed to work  Federal and CA False Claims Act  Provide safe place to report violations  Federal Sentencing Guidelines  Reduce financial risk/loss  CCSF WhistleBlower  Engineer best practices to assure  CCSF Ethics Administrative Code highest level of ethics and integrity possible in the workplace 3

What is Privacy? REGULATIONS GOALS  Federal Healthcare Insurance  Protect patient confidentiality Portability and Accountability  Avoid breaches & fines Act (HIPAA) Privacy Rule and  Engineer data sharing to improve HITECH Rule care coordination and to better  Calif Medical Information Act understand the populations we  Calif W&I Code (Mental Health) serve  Federal 42CFR2 (Sub Abuse) 4

5

The Hard News 6

Whistleblower Complaints FY1415 80 complaints received:  35 Human Resource-related (mistreatment by other employees, unprofessionalism, harassment, misconduct, theft, payroll fraud)  45 Compliance-related (billing fraud, waste, abuse, misuse of City resources, conflict of interest, contractual non-compliance) 65 Investigated & Closed (15 still being investigated): • 36 (55%) not substantiated • 29 (45%) substantiated in whole or part • Corrective Action Plans, including new policies & controls • 2 written warnings, 1 suspension, 2 dismissals 7

Privacy Breaches FY1415 = > $430k anticipated fines 13 Reportable Breaches  10 (77%) Unintentional Mishandling/Loss  5 due to unattended PHI being stolen from cars  3 (23%) Intentional & Unauthorized  Woman impersonated a medical student in Emergency Department  Social Worker “snooped” in a medical record  UCSF physician wrongfully removed >37k documents for 8,000 pts from SFGH 8

Compliance Disallowances FY1415 = $9.7m returned Community Behavioral Health Services Billings: • Juvenile Justice contractor: missing information • Children’s Day Treatment: duplicate billings, insufficient service time • Children’s Intensive Day Treatment: missing information, insufficient service time • Adult Rehab: missing information, insufficient service time SFGH/Primary Care Adult Medicine Clinic Billings : • Insufficient documentation 9

The Good News 10

The Good News Increasing Knowledge Training: Communications: • LHH: >95% completion • One toll-free Hotline Number • SFGH: >90% • Every Fast Facts includes a Compliance or Privacy Corner • Other DPH & Contractors: <50% • SFGH “Privacy Pulse” distributed to all of DPH In process: • Plan to implement LHH’s • Simplified and improved e- practice of recognizing training module Privacy Heroes • 1:1 training planned 11

The Good News Improving Policies Goal is to create a comprehensive set of unduplicated updated policies that are easy to find (web-based) & easy to read • Privacy Policies • Data Security Policies • Compliance Policies 12

The Good News Establishing Data Breach Response Completed: Emergency Quick Reference Response Guide which includes Incident Command To Develop: Preparedness training with Breach Response Team 13

The Good News Establishing Data Sharing Governance Council to review and authorize access to DPH’s protected health information for purposes of: 1. Care Coordination 2. Evaluation 3. Research Codify through contracts, MOUs, Data Use Agreements, Non-Disclosure Agreements 14

The Good News Improving Data Security Measures Completed: 1. Business Associates Agreement 2. Agency attestations that assure level of integrity re Privacy, Data Security & Compliance 3. End User Agreements 4. Identification of who is using which systems 5. Password revisions every 90 days 6. “De-provisioning” users from our data systems 15

The Good News Making Institutional Commitments 1. Increase risk assessments & monitoring to prevent problems before they exist 2. Improve training, policies, communications 3. Centralize functional oversight, accountability and due diligence 4. Support the mission of the Department and serve leadership’s goals: Compliance & Privacy moves from a culture of “NO” to a culture of “YES, and…” 16

Challenges Bolster infrastructure and hire 5 key budgeted positions Codify preventative “ controls ” into electronic data systems Address legislative barriers Stay ahead of cyber criminals and on top of technology security risks and solutions 17

We got this! Office of Privacy & Compliance Affairs compliance.privacy@sfdph.org Confidential Compliance and Privacy Hotline: 1-855-729- 6040 toll-free Calls may be made confidentially and anonymously. Always remember: SFDPH has a non- 18 retaliation policy.